[waraxe-2007-SA#056] - Another Sql Injection in NukeSentinel 2.5.11
====================================================================
Author: Janek Vind "waraxe"
Date: 27. September 2007
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-56.html
Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Developer: http://www.nukescripts.net
NukeSentinel is anti-hacking sofware, used for protection phpnuke
against various security-related attacks.
Vulnerabilities: Critical Sql Injection in "nukesentinel.php"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Let's look at script "includes/nukesentinel.php" source code:
------------>[source code]<------------
function is_god($axadmin) {
global $db, $prefix, $aname;
$tmpadm = base64_decode($axadmin);
$tmpadm = explode(":", $tmpadm);
$aname = $tmpadm[0];
$apwd = $tmpadm[1];
if(!empty($aname) AND !empty($apwd)) {
$aname = trim($aname);
$apwd = trim($apwd);
$admrow = $db->sql_fetchrow($db->sql_query("SELECT * FROM
`".$prefix."_authors` WHERE `aid`='$aname'"));
------------>[/source code]<-----------
So as seen in code snippet above, data from "base64_decode()" function
is used in sql query without any sanityze.
Now is the question, which part of the code uses this function.
Here is the answer:
------------>[source code]<------------
// AUTHOR Protection
$blocker_row = $blocker_array[5];
if($blocker_row['activate'] > 0) {
if(isset($op) AND ($op=="mod_authors" OR $op=="modifyadmin" OR
$op=="UpdateAuthor" OR $op=="AddAuthor" OR $op=="deladmin2" OR
$op=="deladmin" OR $op=="assignstories" OR $op=="deladminconf")
AND !is_god($_COOKIE['admin'])) {
block_ip($blocker_row);
}
}
}
------------>[/source code]<-----------
It's easy to see, that $_COOKIE['admin'] variable will be used as argument
for "is_god()" function. And we have another critical sql injetion in place.
I have written proof-of-concept blind injection exploit for this specific
case and it's working flawlessly.
Happy news to potential victims - developer has allready patched this security
hole in NukeSentinel with releasing new version - 2.5.12
//-----> See ya soon and have a nice day ;) <-----//
How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NukeSentinel's new version 2.5.12 is patched, so download it A.S.A.P.
http://www.nukescripts.net/modules.php?name=Downloads&op=getit&lid=1063
Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, Chb
and anyone else who know me!
Greetings to Raido Kerna.
Tervitusi Torufoorumi rahvale!
Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
come2waraxe (at) yahoo (dot) com [email concealed]
Janek Vind "waraxe"
Homepage: http://www.waraxe.us/
Shameless advertise:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Geology readings - http://geology.oldreadings.com/
Biography Database - http://www.biosaxe.com/
---------------------------------- [ EOF ] ----------------------------
